Search

In order to protect personal information in images, this paper proposed an adversarial image perturbations algorithm to combat deep neural network, which could mine and discover personal image knowledge. It transformed the problem of adversarial example generation into a multi-objective optimization problem with constraints. Considering the classification confidence of the neural network, the location of the perturbed pixels and the chromatic aberration, this paper obtained the adversarial examples iteratively by using the differential evolution algorithm. On MNIST and CIF AR-10 dataset, based on deep neural network LeN et and ResN et, the algorithm generated the experiment of adversarial examples. This paper compared and analyzed the success rate, number of perturbation pixels, optimization effects and spatial characteristics of the adversarial examples. The results show that the proposed algorithm still can effectively combat the deep neural network in the case of few disturbed pixels ( the average number of perturbation pixels is 5) . The algorithm significantly optimizes the location and chromatic aberration of the perturbed pixels, so as to protect personal information without destroying the original image. This study is helpful to balance the relationship between information technology dividend sharing and personal information security, and provides technical support for the research of adversarial examples generation and classification spatial features in deep neural networks. [ABSTRACT FROM AUTHOR]

Black box attack is mainly focuses on the decision information, but there are many query times and the selection of sensitive pixels is difficult. Therefore, this paper proposed a defect sample generation algorithm based on differential evolution. By defining the black box attack as an unconstrained optimization problem, the algorithm used differential evolution to search image sensitive points, and optimized the loss function of decision definition and gradient calculation based on the deep learning model to achieve an effective black box attack. On MNIST and CIF ARlO datasets, the average query times of the proposed algorithm decreased by 28.3% and 14.8% respectively under the same attack success rate. [ABSTRACT FROM AUTHOR]